In this paper, we systematize the community's knowledge on Spectre foundations and
identify the different design choices made by existing work and their tradeoffs.
For example, while there are many choices for a leakage model, the
constant-time [1]} and sandbox
isolation [2]} models are the most pragmatic;
leakage models that only consider the data cache trade off security
for no clear benefits (e.g., of scalability or precision).
As another example, sensible execution models borrow (again) from the
constant-time paradigm: They are detailed enough to capture practical
attacks, but abstract across different hardware—and are thus useful for both
verification and mitigation of software. Other models which capture
microarchitectural details like cache structures make the analysis unnecessarily
complicated: They do not fundamentally capture additional attacks, and they
give up on portability.
Throughout, we discuss the limitations of existing frameworks, the defense
tools built on top of these foundations, and future directions for research.
